No right to derogation
4 min to read

No right to derogation

Date
22 May 2016

There has been a lot of talk about the extended rights of the new General Data Protection Regulation (“GDPR”) for individuals and the possibility to better control personal data. But no right without exceptions and in some cases it is possible to derogate from these rights. This post describes some of the derogations and what they may imply in practice.

The balancing act

Generally speaking, all legislation originates from a balancing act between various considerations. The same applies for legislation on protection of personal data.
As a matter of fact, the legislation on personal data originates from a balancing act between the consideration for safeguarding privacy on the one hand and on the other hand, the consideration for other fundamental rights, including freedom of expression and information and freedom to conduct business etc. Depending on the nature of the personal data, and what it is to be used for, the access to processing the data is restricted.

The right not to be forgotten

The consideration for the freedoms of expression and information is particularly important among the opposite considerations, and it is mentioned several times in the GPDR, e.g. in connection with the right to be forgotten.

An example could be an artist who, as part of his new political provocative work of art, uses old newspaper clippings in which several individuals are named. The individuals strongly disapprove of the work of art as they do not identify with its political statement and consequently they want to exercise their right to be forgotten. In this case, enforcing the right will imply that the names of the individuals were to be erased or blurred which would reduce the artistic merit considerably and consequently limit the freedom of expression of the artist. It is impossible to clearly foresee outcome of such balancing act because it is subject to a concrete judgement that must consider all the facts of the case. Sometimes the consideration for the freedom of expression of the artist outweighs the right of privacy of the individuals and sometimes it is vice versa.

Similar derogations include that the right to access can be derogated from if the right could violate the rights or freedom of other individuals e.g. in a situation where the right to access would imply propounding a patented invention of a third party.

More potential derogations

Moreover, the GPDR prescribes a general access to derogate from the rights of the individuals for the member states if it is necessary for the purposes of public safety, investigating criminal offences and safeguarding general public interests (e.g. budgetary and taxation matters, public health and social security). However, the possibility to introduce broad derogations is subject to strict criteria with regard to the protection of the rights and freedom of the individuals and may not be more extensive than required to fulfil the purpose.

Furthermore, the GDPR allows the member states to introduce national derogations from the rights of the individuals specifically with the purpose of protection the right of freedom of expression and information, including particularly in relation to journalistic, academic, artistic and literary activity.

The balancing by member states with respect to freedom of expression and information may very well result in varying legal status within the member states. This in particular could lead to challenges for international companies with regard to cross-border processing of personal data, e.g. via the internet.

Unpredictable legal status

On a general level, it may be difficult for individuals to predict their legal status in consequence of the derogations. First of all because it will always rely on a concrete balancing of relevant considerations and secondly because it often is unclear where your data may end up and in which contexts it is used (particularly via the internet) and thirdly because the derogations may vary from member state to member state.

(I would like to thank my Bird & Bird colleagues, student assistant Mathias Bartholdy, junior associate Amalie Langebæk and associate Kamilla Pierdola Mondrup, for assisting with this blog entry.)

Share
Written by
Martin von Haller
Martin von Haller
Martin is recognised for his solid legal skills and as an innovative thought leader and strategist within the IT industry. He is a partner in Bird & Bird's International Tech and Comms Group and is based in Denmark. Martin is one of Denmark’s leading IT lawyers with almost 20 years’ experience of advising Danish and international organisations, including large blue chip companies on legal and commercial matters in connection with IT in a wide sense. He is considered a pioneer with respect to legal aspects of Online Technology Solutions (Ecommerce, internet and web services), Cyber and IT security, open source and open data and use of other open licence forms such as Creative Commons.
Related articles
Smart Contracts – Recognising and Addressing the Risks
4 min to read
29 December 2021
Smart Contracts – Recognising and Addressing the Risks
Smart contracts, where some or all of the contractual obligations are defined in and/or performed automatically by a computer program, are expected to have a significant impact on the way business is...
Technology Projects: Managing the Risks of Innovation and Change Part 3: Contract Reset and Dispute Resolution
Technology Projects: Managing the Risks of Innovation and Change Part 3: Contract Reset and Dispute Resolution
Customers in long-term technology projects can find that while they have been working towards their chosen solution a more advanced, cheaper, or simply more desirable technology has become available....
Digital dispute resolution rules to facilitate rapid and cost-effective resolution of disputes involving novel digital technologies
Digital dispute resolution rules to facilitate rapid and cost-effective resolution of disputes involving novel digital technologies
While some saw the development of products using blockchain technology leading to the demise of disputes, the reality is that disputes in the arena of digital technology are increasing in number. Lawtech’s...
Technology Projects: Managing the Risks of Innovation and Change Part 2: During the Life of the Project
Technology Projects: Managing the Risks of Innovation and Change Part 2: During the Life of the Project
Customers in long-term technology projects can find that while they have been working towards their chosen solution a more advanced, cheaper, or simply more desirable technology has become available....
Cookies
We use analytics cookies to help us understand if our website is working well and to learn what content is most useful to visitors. We also use some cookies which are essential to make our website work. You can accept or reject our analytic cookies (including the collection of associated data) and change your mind at any time. Find out more in our Cookie Notice.